Fa, 26. 2015 3:18PM STATE OF INDIANA 


No, 0094 P. 2 



& INDIANA-DATA BREACH NOTIFICATION FORM 

h OA<3 Form 1079 (R1 / 09-14) 

4 IdenBly Theft Unll 


OFFICE OF ATTORNEY GENERAL 
Consumer Protection Division 
Government Center Solid, 6® floor 
' 302 W. Washington Street 
Indianapolis, IN 46204 
il (317)233-4303-Fax 


Name and Address of Entity or Parson iltoi owns or flcansos the (tela 

subject to the breach 

Name 

Warrick County Prosecutor, Child Support Division 


Slreel Address 

City 

1 County Square. Ste 180 

BoonviHe 


Zip Code 
47601 


Submitted by 

Crystal Lynn 

Tide 

Compliance Analyst : 

Dated 

02/26/2016 

Finn Name and Address (if different than entity 

Indiana Department Df Child Services (DCS), Child Support Bureau (CSB) - ^ 

j Telephone 

1 317-233-1663 

i 

Email 


Relertiorrship to Entity whose informatlor 

jwae compromised 

Crystal. Lynn@dc$,in.gov 


State Child Support Bureau 

1 

£ 


Type ol OfganizaiioiT fpfc&se setecr one) j 

0 Slate of Mans Government Agency 

Q Healrh Care 

n NoLFor+’rotit 

0 Other Government Entity 

O Financial Services 

D Other-please speedy 

□ Educalfcmal 

tH Other Commercial 

■■ 1 


Total (Indiana Include 


Indiana Residents Onl 


unknown I Dale Breach Occumad (Aiefwdo sterftend dates if known) | MaPChfApril 2014 


unknown j [ Q ale Breach Discovered 


Data Consumers Notified 


Reason tor delay, If any. In sending noiifiestiort 


the suspected breach is In early stages of investigation by DCS/C3B 

M 

> t| 


| Description ol Breach (se/ecr sll that apply) 



1 1 Inadvertent disclosure 

□ 

External system breach (e.g. hacking) 

n Insider wrong-doing 

m 

Other ’■ jj 

fT Loss or theft of device or media (a.g. computer, laptop, external 


See description below ■; 6 

hanl drive, thumb drive. CD, tape) 


. i 


Infcnnotion Actjuirod (se/acr app/y) ] 

171 Social Security Number 

[2 Name In combination with (refect nil Hint apply) ' ■ Ij 

□ Drivers License Nunbar □ Slam Idenillicalion Number : j 

□ Cmdil Card or Financial Account information 1 

□ Debit Cara Number (in combination with securiy code, access coda, password or pin for account) 


List dales oi previous broach noilltallnns (within test 12 months) 

































Fab, 26. 2015 3;18PM STATE OF INDIANA 


No, 0094 P. 3 


INDIANA DATA BREACH NOTIFICATION FORM 


Page 2 of 2 


Monnoi of Noilfinaiirin to Affected Persons 


Attach a copy of a sample nvVtkrttivn letter 
D Written 
0 Etecfronlc {email) 

0 Telephone 


IdeltiiiyThefi Proteetien Service Offered 


□ Yes 

Duration 

0 No 

Provider 


Brief Description of Servicer 




Any efher Information that may be relevant to the Office of Attorney General In reviewing this liii',ir)«ri| {aflaori additional pages if necessary) 


On Tuesday, 2/24/15, the newly elected Warrick County prosecutor advised a representative of the Indiana Child Support Bureau 
(CSB) that he had recently discovered a breach of electronic security that Is believed to have occurred approximately late March or 
early April 2014. The current prosecutor learned of this incident through conversations with members o^jhis staff Who had served 
under the former prosecutor. The best information available about the incident, at present lime, Is as follows: 

The former prosecutor and her staff had been scanning Title iV-D case files and staring tha scannedifmages in an unsecured 
manner. All files, both open and closed, that had not been to court since 2005 were scannad-in theinentirety. Selected parts of files 
that had gone to court since 20D5 ware also scanned. It is likely that the scanned images contained F7l'| SSNs, and other Pll. 
Allegedly In March or April of 2D14, an unknown entity obtained access to the stored images and either deleted or corrupted the data 
such that the prosecutor's staff could no longer access it. The unknown entity made contact with thejprosecutor’s office and 
demanded a sum of money in exchange far restoring the prosecutor's access In their files, The prosecutor did not respond to the 
demand for money. Instead the prosecutor worked with their private IT vendor (Nomad) to restore the files from a back-up copy. 

The best knowledge available at present time is that the former prosecutor took no further action with regard to the breach. No 
report was made to CSB. It Is unknown whether the entity who gained unauthorized access to the files also copied and retained any 
of the data. , I 

















